VA-003 Compare and configure secrets engines Practice Question
Which TWO best practices should be followed when tuning secrets engine mounts?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure 'max_lease_ttl' to limit the maximum duration secrets can be valid
Setting a low default lease TTL and enforcing maximum TTL per mount helps control secret lifetimes and reduce risk. Disabling using default policy is not a mount tuning best practice, and audit logging is a system-wide setting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable audit logging on the mount to track secret access
Why it's wrong here
Audit logging is enabled globally, not per-mount.
- ✓
Configure 'max_lease_ttl' to limit the maximum duration secrets can be valid
Why this is correct
This ensures even if a role requests a long TTL, it cannot exceed the mount limit.
- ✓
Set 'default_lease_ttl' to a low value appropriate for the secrets engine
Why this is correct
Low default TTLs encourage rotation and reduce exposure.
- ✗
Set a high default lease TTL to reduce renewals
Why it's wrong here
High TTLs increase risk if secrets are compromised, so low TTLs are preferred.
- ✗
Disable the 'default' policy for the mount to restrict access
Why it's wrong here
The default policy is attached to all tokens; disabling it could break functionality.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.